NVIDIA vGPU Manager CVE-2026-47497

Requires the host to be running NVIDIA Virtual GPU Manager with vGPU assigned to guest VMs, and the attacker must already have user-level code execution inside a guest VM (PR:L, local guest context - not remote/network). Exploitation targets the GSP tracing component specifically and depends on manipulating a buffer shared between guest and host, then winning a time-of-check-to-time-of-use race (CWE-367), which is timing-dependent and not guaranteed on each attempt. Limiting factors: no network exposure, guest foothold required, race-window reliability, and relevance is confined to multi-tenant or untrusted-guest vGPU/VDI/cloud-GPU hosts; single-tenant hosts with trusted guests face far lower practical risk.

This is a genuine but locally-scoped priority rather than an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local, low-privilege attacker with full CIA impact - but the description clarifies the 'local' actor is a GUEST VM user reaching the host GPU System Processor (GSP) tracing component through a shared buffer, i.e. a guest-to-host boundary crossing that is the real concern in multi-tenant vGPU/VDI/cloud-GPU deployments. Notably the CWE is CWE-367 (TOCTOU race condition), which conflicts somewhat with the vendor's AC:L: race conditions typically require winning a timing window, so real-world exploitation is likely closer to AC:H (I assess ~7.0) and non-deterministic. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or imminent exploitation. The 'RCE' tag overstates reachability - this is a local guest-context flaw, not remote code execution. Net: patch on a normal-to-elevated cadence for shared/multi-tenant GPU hosts; deprioritize for single-tenant workstation vGPU with trusted guests.

A malicious or compromised user inside a guest VM on a vGPU-enabled host writes crafted data into a buffer shared with the host's GSP tracing component and races the host's time-of-check/time-of-use window to induce improper access. Winning the race lets the guest corrupt or read host GSP state, potentially escalating from guest context toward host code execution, information disclosure, or denial of service affecting co-tenant VMs. No public exploit code is identified at time of analysis, and the TOCTOU nature makes reliable exploitation timing-dependent.